Vikunja versions prior to 2.7.1 contain a CSRF flaw that allows an attacker to force a logged‑in victim to import data from a migration service such as Todoist, Microsoft To Do, or Trello without the victim’s consent; the missing state validation on the OAuth callbacks permits the attacker to supply a callback that creates arbitrary tasks or projects, often with phishing links. This vulnerability does not grant remote code execution or denial of service, but it enables an attacker to inject arbitrary content into the victim’s account, potentially compromising confidentiality, facilitating credential theft, or delivering malware through task links.

go‑vikunja’s Vikunja product, versions older than 2.7.1, is affected. The flaw applies to installations that enable migration through the Todoist, Microsoft To Do, or Trello OAuth callback routes. No sub‑version ranges are listed beyond the "before 2.7.1" qualifier, so any installation relying on these migration paths is vulnerable.

The CVSS score of 5.1 indicates a moderate severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no current evidence of widespread exploitation. Attackers would need to obtain their own OAuth credentials and lure a logged‑in victim to the vulnerable migration callback URL. The missing state parameter allows the attacker to craft a callback that the victim’s browser will follow, resulting in an unauthorized data import. While exploitation requires social engineering or phishing to get the victim to visit the callback, the impact on the victim’s data integrity and potential for phishing content is significant.